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On  June  23,  1998,  about  1601  eastern  daylight  time,  a  Piper  PA-31  Navajo,  N71 1LD,  and 
Grayhawk  06,  a  Navy  Grumman  E-2,  were  involved  in  an  air  traffic  control  (ATC)  operational 
error,1  which  occurred  about  20  miles  southwest  of  Bradford,  Pennsylvania.  Both  airplanes  were 
operating  on  instrument  flight  rules  (IFR)  flight  plans  under  control  of  the  Federal  Aviation 
Administration’s  (FAA)  Cleveland  Air  Route  Traffic  Control  Center  (ARTCC)  Bradford  sector. 
Grayhawk  06  was  northbound,  en  route  from  Norfolk,  Virginia,  to  Wellsville,  New  York,  and 
N71 1LD  was  westbound,  en  route  from  Elmira,  New  York,  to  Akron,  Ohio. 

The  sector  controller  cleared  Grayhawk  06  to  descend  from  18,000  feet  to  10,000  feet  but 
failed  to  notice  that  this  created  a  conflict  with  N711LD,  which  crossed  Grayhawk  06’s 
flightpath  from  east  to  west  at  16,000  feet.  The  two  airplanes  passed  within  2  miles  horizontally 
and  100  feet  vertically.  Conflict  alert  and  operational  error  detection  program  software2  both 
activated  as  a  result  of  this  error  but  not  in  time  for  the  controller  to  intervene  and  prevent  loss  of 
separation.  Traffic  conditions  at  the  time  of  the  error  were  extremely  heavy  and  complex;  as 
many  as  29  aircraft  were  in  the  vicinity  of  the  Bradford  sector  during  the  period  surrounding  the 
error.  There  were  thunderstorms  in  the  area  at  the  time  of  the  incident,  and  several  aircraft  were 
holding  because  of  congestion  in  the  New  York  area. 

Classification  of  Operational  Errors 

An  anonymous  report  made  to  both  the  Department  of  Transportation’s  Inspector 
General’s  Office  and  to  the  Safety  Board  alleged  that  the  reported  incident  involving  N711LD 


1  FAA  Order  7210.3,  “Facility  Operation  and  Administration,”  defines  an  operational  error  as  “an  occurrence 
attributable  to  an  element  of  the  air  traffic  system  which  results  in  less  than  applicable  separation  minima  between 
two  or  more  aircraft.”  In  this  incident,  the  aircraft  were  required  to  be  separated  by  1,000  feet  vertically  and  5  miles 
horizontally. 

-  ARTCCs  are  equipped  with  conflict  alert  and  operational  error  detection  program  software  to  monitor  aircraft 
paths  and  attempt  to  warn  controllers  when  two  aircraft  are  predicted  to  pass  closer  than  permitted  under  standard 
IFR  separation  rules;  in  addition,  this  software  alerts  air  traffic  supervisors  when  two  aircraft  actually  lose  separation 
after  a  conflict  alert  prediction. 
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and  Grayhawk  06  occurred  because  of  excessive  traffic  demand  in  the  Bradford  sector,  that  it 
was  the  third  operational  error  to  occur  in  Cleveland  ARTCC  airspace  within  a  45-minute  period, 
and  that  the  previous  two  errors  had  not  been  reported.3  The  Board  requested  radar  data  and 
other  information  from  the  FAA  on  all  three  incidents  alleged  to  be  errors  and  was  able  to 
corroborate  the  allegations  in  the  anonymous  report.  FAA  Headquarters  Air  Traffic 
Investigations  staff  subsequently  determined  that,  although  the  circumstances  of  the  two 
unreported  errors  were  otherwise  unremarkable,  the  Cleveland  ARTCC  had  improperly  followed 
the  procedures  for  processing  operational  errors  contained  in  FAA  Order  7210.3,  “Facility 
Operation  and  Administration.”  They  also  determined  that  the  unreported  errors,  in  fact,  should 
have  been  reported. 

The  Safety  Board's  investigation  revealed  that  the  methods  used  by  facility  personnel  on 
June  23,  1998,  to  calculate  the  minimum  vertical  and  horizontal  separation  distances  failed  to 
comply  with  the  intent  of  the  procedures  for  identification  of  operational  errors  contained  in  FAA 
Order  7210.56,  “Air  Traffic  Quality  Assurance.”  In  one  of  the  unreported  errors,  the  calculation 
of  vertical  separation  between  two  airplanes  was  determined  following  improper  adjustments  to 
transponder-reported  altitudes.  In  the  other  unreported  error,  the  lateral  separation  between  the 
two  airplanes  was  calculated  by  using  measurements  between  targets  that  did  not  result  in  the 
determination  of  “the  most  probable  trajectory,”  as  required  by  FAA  Order  7210.56.  This  failure 
to  comply  with  FAA  Order  7210.56  by  facility  personnel  resulted  in  two  of  the  three  operational 
errors  not  being  reported.  The  Board  is  concerned  that  such  noncompliance  may  indicate  that 
current  training  for  ATC  personnel  responsible  for  determining  whether  separation  standards 
have  been  violated  is  not  adequate.  Therefore,  the  Safety  Board  believes  that  the  FAA  should 
ensure  that  ATC  personnel  receive  specific  instruction  in  the  acceptable  methods  for  determining 
whether  separation  standards  have  been  violated. 

The  Safety  Board  is  also  concerned  that  such  noncompliance  with  the  procedures  in  FAA 
Order  7210.56  for  identifying  operational  errors  may  not  be  limited  to  Cleveland  ARTCC. 
Because  ATC  operational  errors  may  indicate  that  potential  safety  problems  exist  (such  as  those 
demonstrated  here)  in  the  entire  air  traffic  system,  not  just  in  a  certain  sector,  it  is  important  that 
operational  errors  be  properly  identified,  reported,  and  investigated  to  ensure  that  they  receive  the 
proper  attention  from  FAA  management.  Therefore,  the  Safety  Board  believes  that  the  FAA 
should  review  its  procedures  for  ensuring  that  ATC  personnel  responsible  for  identifying 
operational  errors  understand  and  comply  with  applicable  FAA  directives. 

Traffic  Monitoring  and  Assessment 

FAA  traffic  management  specialists  are  controllers  assigned  to  the  traffic  management 
unit,  which  is  an  ATC  unit  responsible  for  monitoring  major  traffic  flows  within  ATC  facilities 
and  maintaining  a  balance  between  capacity  and  demand.  The  FAA  developed  the  Enhanced 
Traffic  Management  System  (ETMS)  Traffic  Situation  Display  and  accompanying  monitor  alert 
software  to  assist  traffic  management  personnel  in  analyzing  traffic  flows  and  notify  them  of 


3  The  Safety  Board’s  investigation  determined  that  the  two  previous  errors  were  not  reported  outside  the  facility 
because  after  being  examined  by  the  responsible  management  officials  they  were  classified  as  “non-reportable.” 
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situations  in  which  an  airport  or  control  sector  is  expected  to  experience  demand  in  excess  of  a 
specified  level  known  as  the  Monitor  Alert  Parameter  (MAP).  The  MAP  is  generally  based  on 
the  average  time  aircraft  spend  in  a  sector  and  is  initially  set  according  to  procedures  provided  in 
FAA  Order  7210.3,  "Facility  Operation  and  Administration."  Chapter  17,  section  7  of  that  order 
states  the  following: 

the... MAP  establishes  a  numerical  trigger  value  to  provide  notification  to  facility 
personnel,  through  the  MA  [monitor  alert]  function  of  the  ETMS,  that 
sector/airport  efficiency  may  be  degraded  during  specific  periods  of  time.... The 
ability  of  a  functional  position  or  airport  to  provide  ATS  [Air  Traffic  Service] 
may  be  affected  by  a  variety  of  factors  (i.e.  NAVAID’s  [navigational  aid  outages], 
meteorological  conditions,  communications  capabilities,  etc.);  therefore,  MAP  is  a 
dynamic  value  which  will  be  adjusted  to  reflect  the  capabilities  of  the  functional 
position  or  airport. 

Also  according  to  FAA  Order  7210.3,  if  ETMS  predicts  that  traffic  demand  will  exceed 
the  established  MAP  during  any  15-minute  period,  the  monitor  alert  function  will  generate  a 
visual  alert  to  air  traffic  management  personnel  who  are  then  required  to  assess  the  information 
and,  if  the  alert  appears  to  be  valid,  notify  the  operational  supervisor  for  the  affected  sector.  The 
supervisor  can  then  take  appropriate  action. 

When  severe  weather  or  other  conditions  reduce  the  number  of  aircraft  that  can  be  safely 
handled  by  sector  controllers,  the  numerical  value  of  a  particular  sector’s  MAP  should  be 
reduced  in  accordance  with  FAA  Order  7210.3,  which  states  the  following: 

The  MAP  value  will  be  dynamically  adjusted  to  reflect  the  ability  of  the 
functional  position  to  provide  ATS.  During  periods  of  reduced  efficiency  the 
MAP  will  be  dynamically  adjusted  downward  and  conversely,  when  efficiency  is 
improved,  the  MAP  will  be  adjusted  upward,  but  not  to  exceed  the  baseline  or 
documented,  adjusted  value. 

According  to  FAA  Order  7210.3,  determination  and  reduction  of  the  appropriate  MAP 
value  is  the  joint  responsibility  of  the  sector  controllers,  operational  supervisors,  and  traffic 
management  unit  personnel.  Under  normal  conditions,  the  MAP  for  the  Bradford  sector  is  set  to 
1 8.  At  the  time  of  the  incident,  the  sector’s  ability  to  handle  traffic  was  degraded  by  weather  and 
holding  aircraft;  therefore,  the  MAP  should  have  been  reduced  to  a  number  (significantly  lower 
than  1 8)  determined  on  the  basis  of  these  conditions,4  but  it  was  not.  Further,  Bradford  sector 
traffic  demand  peaked  well  in  excess  of  18,  but  no  alert  was  generated  to  warn  air  traffic 
managers  or  operational  supervisors  of  an  impending  or  existing  problem. 


4  The  exact  number  to  which  the  MAP  should  have  been  reduced  cannot  be  determined  because  it  is  a  subjective 
number  determined  by  ATC  personnel  based  on  their  experience,  weather  conditions,  equipment  performance,  and 
other  factors. 
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The  Safety  Board’s  investigation  revealed  that  the  Cleveland  ARTCC  has  no  procedure  to 
ensure  the  necessary  adjustment  of  sector  MAP  numbers;  this  lack  of  procedure  degrades  the 
system's  ability  to  issue  appropriate  monitor  alert  warnings.  During  visits  to  other  ARTCCs, 
Board  investigators  found  that  other  traffic  management  units  also  did  not  adjust  MAPs  as 
required.  Therefore,  the  Safety  Board  believes  that  the  FAA  should  direct  ATC  facilities  using 
ETMS  monitor  alert  software  to  establish  procedures  to  ensure  compliance  with  the  dynamic 
MAP  adjustment  requirements  contained  in  FAA  Order  7210.3,  “Facility  Operation  and 
Administration.” 

Safety  Board  investigators  also  attempted  to  determine  why  no  alert  was  issued  to  warn 
ATC  personnel  of  the  excessive  traffic  demand  in  the  Bradford  sector.  Monitor  alert  trajectory 
predictions  for  each  sector  are  based  on  predicted  climb  and  descent  gradients  used  in 
conjunction  with  routes  and  final  cruise  altitudes  contained  in  IFR  flight  plans.  Traffic  is 
allocated  to  a  particular  sector  at  a  particular  time  in  accordance  with  the  trajectories  predicted  by 
this  process.  If  the  actual  flightpaths  of  the  aircraft  differ  from  those  predicted  trajectories,  ETMS 
traffic  predictions  and  monitor  alert  counts  will  be  inaccurate. 

In  the  Bradford  incident,  several  aircraft  in  the  sector  had  requested  altitudes  well  above 
flight  level  (FL)  270,  the  upper  limit  of  the  Bradford  sector  airspace.  However,  because  of  traffic 
restrictions  implemented  to  reduce  the  workload  of  the  sector  above  Bradford,  the  low-altitude 
sectors  surrounding  Bradford  cleared  these  aircraft  only  to  FL  270,  instead  of  their  requested, 
higher  altitudes.  The  affected  aircraft  were  then  handed  off  to  the  Bradford  sector  instead  of  the 
sectors  above  it.  However,  the  aircraft’s  flight  plan  altitudes  were  not  amended  to  permanently 
reflect  the  change.  Instead,  controllers  chose  to  use  the  temporary  altitude  function  of  the  radar 
data  processing  system  to  display  “T”  altitudes  in  the  data  blocks  of  these  aircraft.  Temporary 
altitudes  are  not  reported  to  ETMS  and  do  not  affect  flight  data  distribution  by  the  National 
Airspace  System  (NAS)  flight  data  processing  system. 

Because  the  ETMS  was  operating  with  incorrect  altitude  data  on  these  flights,  it 
misallocated  the  affected  aircraft  to  sectors  that  they  were  not,  in  fact,  going  to  enter;  this  caused 
inaccurate  monitor  alert  predictions.  Failure  to  update  the  assigned  altitudes  in  the  stored  flight 
plans  when  it  became  apparent  that  these  aircraft  would  be  remaining  at  FL  270  prevented  their 
flight  strips5  from  being  printed  at  the  Bradford  sector.  These  two  occurrences  reduced  the 
reliability  of  the  ETMS  and  contributed  to  the  lack  of  a  monitor  alert  being  generated  for  the 
Bradford  sector.  Controllers  questioned  about  the  use  of  temporary  altitudes  stated  that  they  were 
uncertain  about  their  effects  on  flight  data  processing  and  ETMS  predictions. 

The  FAA  is  increasingly  relying  on  the  use  of  automated  systems,  such  as  ETMS,  for 
traffic  monitoring  and  demand  assessment.  Much  of  the  data  used  by  ETMS  to  perform 
trajectory  estimation  and  other  predictive  tasks  are  sent  to  the  system  as  an  indirect  result  of  NAS 


5  Flight  strips  are  paper  strips  prepared  by  controllers  for  each  flight  that  flies  a  flightpath  that  include  an  airplane’s 
intended  course,  speed,  FL,  and  estimated  time  of  arrival.  Strip  count  is  a  secondary  method  of  predicting  the 
imminent  arrival  of  aircraft  in  a  sector  and  is  often  used  by  supervisors  and  sector  controllers  as  an  indicator  of 
potential  demand. 
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computer  entries  made  by  controllers.  However,  air  traffic  controllers  questioned  about  ETMS 
and  monitor  alerts  appeared  to  have  very  little  knowledge  about  ETMS  processing  and  what 
information  it  uses  to  produce  its  predictions.  The  Safety  Board  is  concerned  that  if  controllers 
do  not  understand  the  effects  that  their  actions  have  on  the  data  made  available  to  ETMS,  they 
may  inadvertently  mislead  the  system  and  reduce  its  effectiveness,  as  occurred  in  this  case. 
Therefore,  the  Safety  Board  believes  that  the  FAA  should  provide  air  traffic  controllers  with 
annual  refresher  training  designed  to  ensure  that  they  understand  the  relationship  between  NAS 
and  ETMS,  including  an  overview  of  ETMS  predictive  functions,  the  data  flow  and  message 
types  exchanged  between  NAS  and  ETMS,  and  the  various  factors  that  may  affect  the  accuracy 
of  ETMS  predictions. 

The  excessive  traffic  level  in  the  Bradford  sector  was  discovered  only  as  a  consequence 
of  the  subsequent  operational  error  investigations  and  would  possibly  not  have  been  discovered 
or  received  management  attention  if  the  error  had  not  occurred.  The  FAA  appears  to  have  no 
formal  process  for  the  identification  and  investigation  of  situations  in  which  a  sector  is  subjected 
to  excessive  traffic  demand  when  no  otherwise  reportable  event  takes  place.  The  Safety  Board  is 
aware  that  the  FAA  has  implemented  a  process  for  reporting  and  tracking  ATC  equipment 
problems  through  Unsatisfactory  Condition  Reports  (UCR);  however,  no  similar  system  exists 
for  procedural  problems.  Therefore,  the  Safety  Board  believes  that  the  FAA  should  establish  a 
formal  method  for  ATC  personnel  to  report  instances  in  which  sectors  become  overloaded 
(similar  to  the  UCR  process),  so  that  the  circumstances  causing  or  permitting  overloading  can  be 
identified  and  addressed. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Ensure  that  air  traffic  control  personnel  receive  specific  instruction  in  the 
acceptable  methods  for  determining  whether  separation  standards  have  been 
violated.  (A-00-23) 

Review  its  procedures  for  ensuring  that  air  traffic  control  personnel  responsible 
for  identifying  operational  errors  understand  and  comply  with  applicable  Federal 
Aviation  Administration  directives.  (A-00-24) 

Direct  air  traffic  control  facilities  using  Enhanced  Traffic  Management  System 
monitor  alert  software  to  establish  procedures  to  ensure  compliance  with  the 
dynamic  Monitor  Alert  Parameter  adjustment  requirements  contained  in  Federal 
Aviation  Administration  Order  7210.3,  “Facility  Operation  and  Administration.” 
(A-00-25) 

Provide  air  traffic  controllers  with  annual  refresher  training  designed  to  ensure 
that  they  understand  the  relationship  between  National  Air  Space  (NAS)  and 
Enhanced  Traffic  Management  Systems  (ETMS),  including  an  overview  of  ETMS 
predictive  functions,  the  data  flow  and  message  types  exchanged  between  NAS 


6 

and  ETMS,  and  the  various  factors  that  may  affect  the  accuracy  of  ETMS 
predictions.  (A-00-26) 

Establish  a  formal  method  for  air  traffic  control  personnel  to  report  instances  in 
which  sectors  become  overloaded  (similar  to  the  Unsatisfactory  Condition  Report 
process),  so  that  the  circumstances  causing  or  permitting  overloading  can  be 
identified  and  addressed.  (A-00-27) 

Chairman  HALL  and  Members  HAMMERSCHMIDT,  GOGLIA,  and  BLACK  concurred 
in  these  recommendations. 


By: 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  April  24,  2000 

In  reply  refer  to:  A-00-28  and  -29 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  September  11,  1999,  about  1958  central  daylight  time,  a  runway  incursion  involving 
United  Airlines  2  (UAL2),  a  Boeing  767,  and  Delta  Air  Lines  flight  1211  (DAL1211),  a  Boeing 
727,  occurred  at  Chicago  O’Hare  International  Airport  (ORD),  Chicago,  Illinois.  UAL2,  which 
was  being  repositioned  on  the  airport  by  two  UAL  mechanics,  crossed  runway  9L  without  air 
traffic  control  (ATC)  clearance.  DAL1211,  which  was  departing  from  runway  9L  at  the  time, 
passed  directly  over  UAL2  at  an  altitude  of  200  to  300  feet.  The  incident  occurred  in  darkness 
under  visual  meteorological  conditions.  Neither  airplane  was  damaged,  and  no  injuries  were 
reported. 

The  UAL2  maintenance  crew  was  repositioning  the  airplane  from  ORD’s  International 
West  terminal  east  to  gate  Cll.  The  ORD  ground  controller  instructed  the  UAL2  crew  to  taxi 
from  the  International  West  terminal  to  the  “north  port”1  via  taxiway  B,  the  Bravo  bridge,  runway 
32R,  and  taxiway  H.  (See  figure  1.)  The  crew  became  uncertain  of  the  airplane’s  position, 
missed  the  turn  onto  taxiway  H,  and  continued  along  runway  32R  toward  its  intersection  with 
runway  9L.  The  UAL2  crew  and  the  tower  ground  controller  simultaneously  detected  the  error. 
As  the  crew  was  applying  the  brakes,  the  ground  controller  instructed  UAL2  to  stop  and  hold  its 
position  on  runway  32R.  Both  the  tower  local  and  ground  controllers  independently  observed 
UAL2's  position  and  decided  that  the  airplane  had  stopped  clear  of  runway  9L. 

Perceiving  no  conflict,  the  local  controller  then  cleared  DAL1211  for  takeoff  from 
runway  9L.  Unknown  to  either  of  the  tower  controllers,  the  UAL2  crew  believed  that  the 
airplane  had  entered  runway  9L  and  was  partially  obstructing  it.  The  UAL2  crew  members 
attempted  to  contact  the  local  controller  when  they  saw  DAL1211  beginning  its  departure  roll  on 
runway  9L  but  were  told  to  “stand  by.”  To  prevent  a  possible  collision,  the  UAL2  crew  decided 


1  The  north  port  is  the  entrance  to  the  nonmovement  area  located  between  terminals  B  and  C. 
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to  taxi  ahead  and  exit  runway  9L  on  the  opposite  side.  The  DAL1211  crew  statements  stated  that 
part  way  through  the  takeoff  roll  they  saw  UAL2  on  the  runway  ahead  of  them,  at  which  point, 
they  performed  an  early  rotation  and  proceeded  to  pass  directly  over  UAL2  at  an  altitude  of  200 
to  300  feet. 


Figure  1.  ORD  Airport  Diagram 


Safety  Board  investigators  found  that  the  taxi  route  assigned  for  use  between  taxiways  B 
and  H  at  the  time  of  the  incident  was  not  the  taxi  route  usually  assigned.  Aircraft  taxiing 
between  taxiways  B  and  H  would  normally  follow  taxiway  P;  however,  a  section  of  taxiway  P 
had  been  closed  for  several  weeks  for  reconstruction.  The  tower  controllers  elected  to  use 
runway  32R  as  a  taxiway  to  bypass  the  closed  section  of  taxiway  P.  The  UAL2  crew  was  not 
familiar  with  that  part  of  the  route,  and  no  signage  identified  taxiway  H  at  its  intersection  with 
runway  32R. 


Investigation  revealed  that  the  ORD  airport  certification  manual  approved  by  the  Federal 
Aviation  Administration  (FA A),  pursuant  to  14  Code  of  Federal  Regulations  Part  139,  does  not 
require  a  sign  at  the  intersection  of  taxiway  H  and  runway  32R  because  it  is  close  to  the  threshold 
of  runway  32R  and  aircraft  do  not  normally  turn  off  there.  However,  when  the  tower  controllers 
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elected  to  use  runway  32R  to  bypass  the  unusable  segment  of  taxiway  P,  the  intersection  of 
runway  32R  and  taxiway  H  became  a  frequently  used  taxi  route  for  aircraft  crossing  the  airport 
from  west  to  east.  The  tower  controllers  involved  in  this  incident  reported  that  they  were  not 
aware  that  the  intersection  was  unmarked,  and  airport  management  staff  stated  that  they  had  not 
been  informed  of  the  tower’s  plan  to  route  aircraft  on  runway  32R  to  taxiway  H  during  the 
construction  period.  Following  the  incident,  airport  management  constructed  a  temporary  sign 
and  installed  it  at  the  runway  32R/taxiway  H  intersection. 

The  mechanic  who  was  taxiing  UAL2  stated  that  he  was  looking  for  a  sign  identifying 
taxiway  H.  Both  crewmembers  stated  that  the  area  was  very  dark  and  that  they  did  not  see  any 
signs  or  lights  identifying  taxiway  H.  Thus,  the  absence  of  appropriate  signage  and  markings  at 
the  runway  32R/taxiway  H  intersection  apparently  contributed  to  the  loss  of  situational 
awareness  experienced  by  the  UAL2  crew,  causing  them  to  miss  the  turn  onto  taxiway  H.  This 
potential  problem  might  have  been  detected  and  addressed  if  ORD  s  ATC  managers  had 
informed  airport  management  about  its  alternate  taxi  plan  and  asked  that  the  route  be  checked  for 
adequate  signage  and  markings.  Detection  and  correction  of  such  problems  is  important  because, 
especially  in  unfamiliar  situations,  flight  and  ground  crews  depend  on  proper  signs  and  surface 
markings  to  maintain  situational  awareness  and  avoid  runway  incursions.  Therefore,  the  Safety 
Board  believes  that  the  FAA  should  amend  FAA  Order  7210.3,  "Facility  Operation  and 
Administration,"  to  require  tower  ATC  managers  to  monitor  planned  airport  construction  projects 
or  other  activities  that  may  require  significant  use  of  nonstandard  taxi  routes  and  coordinate  with 
airport  management  to  ensure  that  such  routes  are  inspected  for  adequate  signage  and  markings. 

Following  this  incident,  UAL  conducted  a  comprehensive  review  of  its  internal 
procedures  for  ensuring  that  maintenance  personnel  assigned  to  taxi  aircraft  are  provided  with 
appropriate  airport  surface  charts  and  other  information  (such  as  notices  to  airmen)  about 
construction  activities  related  to  airport  surface  operations.  The  Safety  Board  notes  that  there  are 
no  Federal  Aviation  Regulations  that  address  ground  operation  of  aircraft  on  an  airport  without 
intent  to  fly  and  that  this  lack  of  regulation  essentially  leaves  the  management  of  such  activities 
up  to  individual  aircraft  operators.  Safety  would  be  enhanced  if  all  air  carriers  currently 
employing  nonpilot  personnel  to  move  aircraft  on  airports  conducted  reviews  similar  to  that 
performed  by  UAL  following  this  incident.  Therefore,  the  Board  believes  that  the  FAA’s  Flight 
Standards  Service  should  publish  a  flight  standards  handbook  bulletin  to  its  principal  operations 
inspectors  describing  the  incident  and  recommending  that  carriers  review  the  adequacy  of  their 
procedures  for  ensuring  that  personnel  assigned  to  move  aircraft  have  received  sufficient  training 
and  information  to  do  so  safely. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 


Amend  Federal  Aviation  Administration  Order  7210.3,  "Facility  Operation  and 
Administration,"  to  require  tower  air  traffic  control  managers  to  monitor  planned 
airport  construction  projects  or  other  activities  that  may  require  significant  use  of 
nonstandard  taxi  routes  and  coordinate  with  airport  management  to  ensure  that 
such  routes  are  inspected  for  adequate  signage  and  markings.  (A-00-28) 
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Publish  a  flight  standards  handbook  bulletin  to  its  principal  operations  inspectors 
describing  the  September  11,  1999,  runway  incident  between  Delta  Air  Lines 
flight  211  and  United  Airlines  2  and  recommending  that  carriers  review  the 
adequacy  of  their  procedures  for  ensuring  that  personnel  assigned  to  move  aircraft 
have  received  sufficient  training  and  information  to  do  so  safely.  (A-00-29) 

Chairman  HALL  and  Members  HAMMERSCHMIDT,  GOGLIA,  and  BLACK  concurred 
with  these  safety  recommendations. 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  April  11,  2000 

In  reply  refer  to:  A-00-30  and  -3 1 


Honorable  Jane  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


In  this  letter,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration  (FA A)  take  actions  to  address  safety  issues  concerning  the  current  lack  of 
cockpit  imagery  and  the  location  of  flight  recorder  circuit  breakers.  These  recommendations  were 
prompted  by  the  lack  of  valuable  cockpit  information  during  the  investigations  of  several  aircraft 
incidents  and  accidents,  including  USAir  flight  105  on  September  8,  1989,  ValuJet  flight  592  on 
May  11,  1996,  SilkAir  flight  185  on  December  19,  1997,  Swissair  flight  111  on  September  2, 
1998,  and  EgyptAir  flight  990  on  October  31,  1999.  This  letter  summarizes  the  Safety  Board’s 
rationale  for  issuing  the  recommendations. 

In  its  report  on  the  September  8,  1989,  incident  involving  USAir  flight  105,  a  Boeing  737, 
at  Kansas  City,  Missouri,  the  Safety  Board  cited  the  need  for  a  video  recording  of  the  cockpit 
environment.1  The  report  pointed  out  the  limitations  of  existing  flight  recorders  to  fully  document 
the  range  of  the  flight  crew  actions  and  communications.  It  also  noted  that  the  introduction  of 
aircraft  with  electronic  “glass”  cockpits  and  the  use  of  data  link  communications  would  enable  the 
flight  crew  to  make  display  and  data  retrieval  selections  that  will  be  transparent  to  the  cockpit 
voice  recorder  (CVR)  and  digital  flight  data  recorder  (DFDR).  The  Safety  Board  indicated  that  it 
would  monitor  and  evaluate  progress  in  the  application  of  video  technology  to  the  cockpits  of  air 
transports.  In  the  9  years  since  that  incident,  considerable  progress  has  been  made  in  video  and 
flight  recorder  technologies,  and  the  need  for  video  recording  has  become  more  evident. 
Electronic  image  recording  of  the  cockpit  environment  is  now  both  technologically  and 
economically  feasible. 

On  May  11,  1996,  the  crew  of  ValuJet  flight  592,  a  DC-9-32,  reported  smoke  and  fire 
shortly  after  departing  Miami,  Florida.  The  flight  recorders  stopped  about  40  to  50  seconds 
before  the  airplane  crashed  on  its  return  to  the  airport,  killing  all  111  passengers  and  crew.  The 
exact  smoke  and  fire  conditions  that  were  present  in  the  cockpit  during  the  last  few  minutes  of 
flight  are  not  known. 


'National  Transportation  Safety  Board.  1990.  USAir  Flight  105,  Boeing  737-200,  N283AU,  Kansas  City 
International  Airport,  Missouri,  September  8,  1989.  Aircraft  Incident  Report  NTSB/ AAR-90/04.  Washington,  DC. 
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On  December  19,  1997,  SilkAir  flight  185,  a  Boeing  737,  entered  a  rapid  descent  from 
35,000  feet,  which  ended  with  a  high  speed  impact  in  the  Sumatran  River  near  Palembang, 
Indonesia.  There  were  104  fatalities.  The  Indonesian  investigation,  in  which  the  Safety  Board 
participated,  determined  that  both  flight  recorders  stopped  prior  to  the  airplane  entering  the  rapid 
descent.  The  lack  of  recorded  information  concerning  the  circumstances  in  the  cockpit  has 
continued  to  hamper  the  investigation. 

On  September  2,  1998,  Swissair  flight  111,  an  MD-1 1,  on  a  regularly  scheduled  passenger 
flight  from  New  York  to  Geneva,  Switzerland,  diverted  to  Halifax  after  the  crew  reported  smoke 
in  the  cockpit,  the  airplane  crashed  into  the  waters  near  Peggy’s  Cove,  Nova  Scotia,  killing  all  229 
passengers  and  crew  on  board.  The  exact  cockpit  smoke  and  fire  conditions  that  led  to  the  crew’s 
decision  to  descend  from  cruise  flight  and  to  divert  to  Halifax  is  unknown. 

On  October  31,  1999,  Egypt  Air  flight  990,  a  Boeing  767-3  66-ER,  on  a  scheduled 
international  flight  from  New  York  to  Cairo,  crashed  in  the  Atlantic  Ocean  about  60  miles  south 
of  Nantucket  Island,  Massachusetts,  killing  all  217  passengers  and  crew.  The  Safety  Board 
investigators,  in  close  cooperation  with  Egyptian  government  officials,  are  trying  to  determine  the 
circumstances  that  caused  the  aircraft  to  descend  from  its  cruising  altitude  and  to  impact  the 
ocean.  The  DFDR  and  CVR  yielded  some  information,  but  questions  still  remain  as  to  the  exact 
environment  in  the  cockpit  prior  to  the  upset. 


These  accidents  are  just  the  most  recent  in  a  long  history  of  accident  and  incident 
investigations  that  might  have  benefited  from  the  capture  of  a  graphic  record  of  the  cockpit 
environment.  Reconstructing  the  events  that  led  to  many  accidents  has  been  difficult  for 
investigators  because  of  limited  data.  This  lack  of  information  was  evident  during  the  ValuJet 
investigation.  Although  the  conventional  CVR  and  DFDR  recorded  sounds  and  relatively 
comprehensive  airplane  data  at  the  time  of  the  initial  fire,  they  did  not  show  the  cockpit 
environmental  conditions  that  the  flight  crew  faced  during  the  initial  portion  of  the  fire.  This 
information  is  critical  in  determining  whether  the  crew  had  subtle  indications  of  smoke  or  fire, 
whether  they  followed  procedures,  or  whether  or  not  their  actions  were  effective  in  clearing 
smoke  from  the  cockpit.  If  the  conditions  were  known,  it  might  be  possible  to  modify  aircraft 

systems  or  training  programs  to  assist  future  crews  in  recognizing  these  indications  and  effecting  a 
safe  recovery. 

The  Swissair  MD-1 1  accident  was  very  similar  to  the  ValuJet  accident,  except  the  fire  is 
not  believed  to  have  progressed  as  quickly,  giving  the  crew  more  time  to  attempt  to  effect  a  safe 
recovery.  However,  the  lack  of  cockpit  imagery  has  resulted  in  many  unanswered  questions  about 
the  origin  of  the  fire,  the  first  indications  of  a  fire  in  the  cockpit,  the  procedures  used,  and  the 
effectiveness  of  the  procedures  in  clearing  smoke  from  the  cockpit.  Questions  also  remain 
regarding  the  progression  of  the  fire,  the  availability  of  critical  flight  instruments,  and  whether  the 
crew  was  overcome  or  debilitated  by  the  smoke  and  fire  during  the  final  minutes  of  the  flight. 

The  Safety  Board’s  current  investigation  of  the  crash  of  EgyptAir  flight  990,  a  Boeing  767 
aircraft,  further  highlights  the  need  for  electronic  cockpit  imagery  on  commercial  transport 
aircraft.  Even  though  the  aircraft  was  equipped  with  a  30-minute  CVR  and  a  DFDR  that  sampled 
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over  150  parameters,  the  Safety  Board  is  concerned  that  the  full  circumstances  that  led  to  the 
descent  into  the  ocean  may  never  be  fully  understood  because  of  the  lack  of  electronic  cockpit 
imagery.  The  data  appear  to  indicate  that  the  flight  was  proceeding  normally  at  about  33,000  feet 
until  the  autopilot  disconnected.  About  8  seconds  later,  a  large  nose-down  elevator  deflection  and 
reduction  of  power  to  both  engines  were  recorded,  and  the  airplane  began  a  rapid  descent. 
During  this  descent,  the  airplane  reached  a  maximum  nose-down  pitch  angle  of  about  40°.  The 
last  few  seconds  of  the  data  recorder  showed  that  the  pitch  attitude  of  the  aircraft  rose  to  about 
10°  nose  down.  It  also  showed  an  elevator  split  in  the  last  15  seconds,  during  which  the  No.  1 
elevator  (left,  or  captain’s  side)  was  in  the  nose-up  position,  while  the  No.  2  elevator  (right,  first 
officer’s  side)  was  in  the  nose-down  position.  The  maximum  split  between  the  elevators  during 
that  period  was  about  7°.  In  the  last  second  of  data,  the  elevator  split  appeared  to  be  lessening. 
DFDR  parameters  “engine  start  lever,”  both  left  and  right,  changed  from  “run”  to  “cut-off.”  The 
changes  in  these  and  other  engine  parameters  are  consistent  with  both  engines  shutting  down. 
Also,  the  speed  brake  handle  moved  from  the  stowed  position  to  the  deployed  position.  The 
origins  of  the  actions,  as  well  as  the  circumstances  prompting  the  actions,  that  resulted  in  the 
changes  in  the  aircraft’s  controls  may  never  be  definitively  resolved  because  of  the  lack  of 
electronic  images  of  the  cockpit.  The  Safety  Board  continues  to  actively  gather  more  information 
in  an  attempt  to  answer  the  unresolved  questions,  but  the  Board  does  not  have  any  direct 
evidence  of  these  actions  in  the  cockpit. 

The  international  aviation  community  is  aware  of  the  safety  benefits  of  crash-protected 
video  recorders.  Agenda  item  3  of  ICAO’s  FLIRECP/22  specifically  dealt  with  the  need  for 
standards  and  recommended  practices  (SARPs)  concerning  video  recordings.  The  panel  agreed 
that  the  use  of  video  recordings  in  aircraft  cockpits  would  be  very  useful  and  noted  that 
EUROCAE3  was  developing  minimum  operational  performance  specifications  (MOPS).  The 
panel  agreed  that  video  technology  was  maturing  to  the  point  where  specific  technical  aspects  (for 
example,  frame  rate,  number  of  cameras,  and  resolution  per  frame)  must  be  determined,  and  that 
the  ongoing  work  of  EUROCAE  and  ARINC4  should  be  considered  when  developing  video 
recorder  SARPs.  The  panel  concluded  that  it  was  “strongly  committed  to  the  introduction  of 
video  recordings  in  an  appropriate  and  agreed  format,  and  that  this  should  form  part  of  the  future 
work  of  the  panel.” 

EUROCAE  Working  Group  50  (WG50)  began  drafting  the  fundamental  needs  for  video 
recorders  at  its  February  1999  meeting,  which  was  attended  by  recorder  manufacturers, 
regulatory  authorities,  and  accident  investigators  from  around  the  world,  including  the  Safety 
Board  and  the  FAA.  On  February  8,  2000,  the  Safety  Board  issued  Safety  Recommendation  A- 
99-59,  which  asked  the  FAA  to  incorporate  EUROCAE’ s  performance  standards  for  a  crash- 
protected  video  recording  system  into  a  technical  standard  order  (TSO).5  Given  that  the 


2  International  Civil  Aviation  Organization  (ICAO),  Flight  Recorder  Panel  second  meeting  (FLIRECP/2), 
November  1998. 

3  European  Organization  for  Civil  Aviation  Equipment  (EUROCAE). 

4  ARINC,  located  in  Annapolis,  Maryland,  is  a  private  corporation  whose  principal  stockholders  are 
international  air  carriers.  ARINC  provides  the  aviation  industry  with  communications  and  information  processing 
systems  and  services,  system  engineering,  and  standards. 

5  The  current  status  of  Safety  Recommendation  A-99-59  is  “Open — Await  Response.” 


4 


fundamental  needs  for  cockpit  image  recording  are  expected  to  be  finalized  by  WG50  during  the 
first  half  of  2000,  the  Safety  Board  encourages  the  FAA  to  work  with  EUROCAE  to  help 
expedite  the  finalization  of  the  WG50  MOPS  and  to  incorporate  the  performance  standards 
defined  in  the  MOPS  into  an  FAA  TSO  for  a  crash-protected  cockpit  image  recording  system  as 
soon  as  practicable. 

The  unresolved  issues  in  the  EgyptAir  investigation  regarding  the  circumstances  and 
actions  taken  in  the  cockpit  could  exist  in  any  transport  category  aircraft.  Cockpit  imagery  would 
provide  key  information  that  cannot  be  obtained  from  a  CVR  or  a  DFDR  regarding  the  cockpit 
environment  and  actions  taken  within  the  cockpit,  including  those  prompted  by  nonverbal 
communications.  Therefore,  in  order  to  document  the  conditions  that  occur  in  a  cockpit  prior  to 
an  accident,  the  Safety  Board  believes  that  all  aircraft  operated  under  Title  14  Code  of  Federal 
Regulations  Part  121,  125,  or  135,  and  required  to  be  equipped  with  a  CVR  and  DFDR  should 
also  be  equipped  with  a  crash-protected  cockpit  image  recorder  of  a  2-hour  minimum  duration. 

With  the  experience  that  the  Safety  Board  has  gained  during  the  EgyptAir  investigation, 
the  Board  believes  that  the  critical  elements  which  need  to  be  recorded  by  a  cockpit  image 
recorder  include  the  identities,  locations,  and  actions  of  the  people  in  the  cockpit.  The  camera(s) 
do  not  have  to  be  mounted  such  that  they  are  pointed  at  the  faces  of  the  crew  while  in  flight. 
Color  images  are  required  to  clearly  discern  instrument  readings.  In  glass  cockpits,  color  is  used 
to  provide  additional  information,  such  as  warnings  and  status.  The  color  image  of  the  cockpit 
must,  at  a  minimum,  be  able  to  document  where  all  of  the  crewmembers  are  at  any  given  time 
while  in  the  cockpit.  In  addition,  a  color  image  of  the  flight  control  positions  and  exact  crew 
movements  must  be  documented.  All  views  must  be  captured  under  all  lighting  conditions, 
including  bright  sunlight  and  darkness.  The  number  of  cameras  used  should  be  the  number 
necessary  to  adequately  capture  these  color  images. 

The  process  of  capturing  and  recording  an  electronic  image  is  subject  to  many  factors. 
These  factors  affect  the  viewer’s  ability  to  discern  motion  of  an  object.  They  also  affect  how 
clearly  the  object  can  be  distinguished  from  the  general  background  scene.  Among  the  key 
factors  in  determining  the  overall  quality  of  digital  imagery  are  frame  rate,  resolution,  camera 
position,  lighting,  lens  type,  and  the  compression  algorithm  used  on  the  data. 

The  Safety  Board  understands  that  the  EUROCAE  specifications  will  define  several  of 
these  key  factors,  including  frame  rate  and  resolution.  The  Safety  Board  recognizes  that  because 
of  technical  considerations,  the  minimum  frame  rate  will  be  less  than  the  typical  30  frames  per 
second  in  the  video  industry.  However,  the  Board  believes  that  the  frame  rate  combined  with  the 
minimum  resolution  must  be  sufficient  to  capture  actions,  such  as  display  selections  or  system 
activations,  during  the  crucial  final  portion  of  the  recording.  Given  a  2-hour  recording 
requirement,  the  Safety  Board  further  recognizes  that  a  tradeoff  of  frame  rate,  resolution,  and 
recorder  memory  may  be  necessary.  For  example,  the  final  30  minutes  of  recording  might  have  a 
higher  frame  rate  than  the  earlier  90  minutes  of  recording,  which  might  have  a  reduced  resolution 
or  minimum  frame  rate  that  is  still  sufficient  to  determine  motion.  The  remainder  of  the 
specifications  should  be  mixed  appropriately  in  order  to  achieve  the  required  cockpit  imagery 
under  all  lighting  scenarios,  and  for  a  sufficient  recording  duration. 
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A  strong  justification  for  the  use  of  cockpit  image  recorders  involves  the  expected  future 
requirement  to  record  data  link  communications.  By  about  2004,  analog  CVRs  will  no  longer 
meet  the  requirements  for  aircraft  using  controller-pilot  data  link  (CPDL)  communications.  It  is 
anticipated  that  future  regulatory  changes  will  require  that  aircraft  using  CPDL  communications 
be  outfitted  with  some  means  of  recording  this  information.6  To  that  end,  the  Safety  Board 
encourages  industry  to  consider  the  use  of  cockpit  image  recorder  technology  as  a  means  of 
compliance  on  airplanes  using  CPDL  communications.  Adding  a  properly  placed  cockpit  video 
camera  would  allow  data  link  messages  displayed  to  the  crew  to  be  recorded  on  the  image 
recorder.  The  use  of  video  technology  would  not  require  any  modifications  to  the  existing 
aircraft’s  communication  or  display  systems.  This  might  greatly  reduce  the  time  and  expense  of 
retrofitting  older  aircraft  to  record  CPDL  messages. 

The  installation  of  a  cockpit  image  recording  system  to  most  aircraft  would  probably 
necessitate  adding  an  additional  recorder  unit  to  the  aircraft.  In  a  March  9,  1999,  letter  to  the 
FAA,  the  Safety  Board  recommended  that  a  10-minute  auxiliary  power  source  be  required  for 
existing  CVRs  and  that  all  newly  manufactured  aircraft  be  equipped  with  two  combination 
CVR/DFDR  recording  systems,  one  located  in  the  front  of  the  aircraft  and  the  other  located  as  far 
aft  as  possible  (Safety  Recommendations  A-99-16  and  -17).7  The  Safety  Board  believes  that 
these  same  arguments  also  apply  to  a  cockpit  image  recorder,  which  could,  in  some  investigations, 
be  the  primary  tool  in  documenting  the  circumstances  leading  up  to  the  accident  or  incident; 
consequently,  the  same  10-minute  independent  power  requirement  should  be  mandatory  in  any 
image  recorder  installation.  Several  of  the  recorder  manufacturers  are  considering  designs  that 
would  incorporate  all  of  the  recording  requirements  in  one  box.  These  designs  would  be  capable 
of  recording  the  audio  (CVR  function),  the  data  (the  DFDR  function),  the  CPDL,  and  image 
functions  in  one  self-contained  unit  (CVR/DFDR/IMAGE).  The  Safety  Board  believes  that  this 
type  of  multi-function  recording  unit  would  provide  the  maximum  reliability  and  redundancy 
needed  for  a  newly  manufactured,  modem  aircraft. 

There  are  other  issues  of  importance  to  the  Safety  Board  with  regard  to  the  addition  of  a 
cockpit  image  recorder  system.  One  issue  is  the  need  to  time-synchronize  CVR,  DFDR,  and 
cockpit  image  recorders.  The  use  of  a  combination  CVR/DFDR/IMAGE  unit  will  accomplish  this 
synchronization  and  provide  a  common  time  reference. 

Another  issue  is  the  location  of  the  circuit  breaker  for  the  cockpit  image  recorder  system. 
To  ensure  that  the  recording  of  images  cannot  be  selectively  disabled  (by  cockpit  crews),  the 
Safety  Board  believes  it  should  not  be  possible  to  access  the  circuit  breaker  for  the  cockpit  image 
recorder  system  in  the  cockpit  during  flight.  Initially,  it  was  believed  that  in  order  to  prevent  in¬ 
flight  incidents  from  being  overwritten  on  the  flight  recorders,  particularly  on  30-minute  CVRs, 
that  it  was  necessary  to  have  the  flight  recorder  circuit  breakers  accessible  in  the  cockpit  to  allow 
for  them  to  be  turned  off  to  preserve  the  recorded  information.  However,  the  Safety  Board  has 
been  involved  in  a  recent  accident  investigation  in  which  it  has  become  evident  that  the 


6  The  FAA  has  indicated  that  it  will  initiate  rulemaking  to  clarify  that  the  present  requirement  to  record  all 
voice  messages  be  expanded  to  include  cockpit  data  messages.  According  to  the  FAA,  the  rulemaking  is  expected 
to  take  effect  about  2004. 

7  The  current  status  of  Safety  Recommendations  A-99-16  and  -17  is  “Open — Acceptable  Response.” 
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accessibility  of  the  circuit  breakers  may  have  played  a  role  in  the  recorders  stopping  before 
impact.  In  the  SilkAir  accident,  the  CVR  stopped  recording  5  minutes  58  seconds  prior  to  the 
DFDR,  which  stopped  1  minute  54  seconds  prior  to  impact.  Investigators  have  been  unable  to 
find  any  indications  of  problems  or  possible  failure  modes  that  would  have  led  to  the  CVR  and  the 
DFDR  stopping  at  different  times  before  impact.  One  possible  explanation  would  be  that  the 
circuit  breakers  were  pulled  from  within  the  cockpit.  Given  the  possibility  of  a  situation  such  as 
this  occurring  and  the  pending  rulemaking  to  require  2-hour  CVRs,  the  Safety  Board  believes  that 
circuit  breakers  for  all  CVRs,  DFDRs,  and  cockpit  image  recorders  should  be  inaccessible  during 
flight. 


The  following  list  summarizes  the  Safety  Board’s  minimum  requirements  for  a  cockpit 
image  recorder: 

•  Recording  duration  should  be  2  hours. 

•  Color  images  should  be  recorded  from  all  cameras. 

•  Recorded  images  should  be  captured  under  all  lighting  conditions. 

•  The  entire  cockpit  image  should  be  recorded,  including  views  of  each  control  position 
and  actions  taken  by  people  in  the  cockpit. 

•  The  number  of  cameras  should  be  the  number  necessary  to  adequately  capture  these 
images. 

•  The  frame  rate  and  resolution  should  be  sufficient  to  capture  motion  and  critical 
actions,  such  as  display  selections  or  system  activations. 

•  The  recorder  should  have  an  independent  power  supply  capable  of  providing  power 
for  10  minutes. 

•  Circuit  breakers  should  be  inaccessible  during  flight. 

In  the  1960s,  the  bold  support  of  the  airline  pilots  and  the  wisdom  of  the  aviation 
community  were  instrumental  in  ensuring  that  accurate,  complete  information  of  cockpit 
communications  was  secured  for  accident  prevention  purposes.  Many  of  the  advances  in  aviation 
safety  since  that  time  can  be  directly  traced  to  the  visionary  installation  of  CVRs  and  the  crucial 
information  captured  by  these  devices.  Imaging  technology  has  advanced  to  the  point  where  the 
aviation  community  is  now  on  the  threshold  of  a  new  generation  of  recorders  that  will  lead  to 
even  greater  understanding  of  the  root  causes  of  accidents  and  build  upon  the  solid  safety 
foundation  that  has  been  made  possible  by  CVRs. 

The  Safety  Board  recognizes  the  privacy  issues  with  recording  images  of  pilots.  However, 
the  Board  believes  that  given  the  history  of  complex  accident  investigations  and  lack  of  crucial 
information  regarding  the  cockpit  environment,  the  safety  of  the  flying  public  must  take 
precedence.  In  the  interest  of  protecting  the  use  of  any  recorded  images,  the  Safety  Board  has 
requested  that  Congress  implement  the  same  provisions  that  exist  for  CVRs  for  the  use  of  image 
recorders  in  all  modes  of  transportation.  Pending  authorization,  a  cockpit  image  recorder  would 
be  protected  by  the  Safety  Board  in  the  same  rigorous  manner  as  a  CVR. 
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Safety  Recommendation  A-99-16,  mentioned  earlier  in  this  letter,  asked  that  all  existing 
flight  recorders  be  retrofitted  with  an  auxiliary  power  supply,  and  also  that  a  2-hour  CVR  be 
installed  by  January  1,  2005.  The  Safety  Board  believes  this  date  is  also  appropriate  for  the 
incorporation  of  crash-protected  cockpit  image  recorders.  Therefore,  the  Safety  Board  believes 
that  the  FAA  should  require  that  all  aircraft  operated  under  Part  121,  125,  or  135  and  currently 
required  to  be  equipped  with  a  CVR  and  DFDR  be  retrofitted  by  January  1,  2005,  with  a  crash- 
protected  cockpit  image  recording  system.  The  cockpit  image  recorder  system  should  have  a  2- 
hour  recording  duration,  as  a  minimum,  and  be  capable  of  recording,  in  color,  a  view  of  the  entire 
cockpit  including  each  control  position  and  each  action  (such  as  display  selections  or  system 
activations)  taken  by  people  in  the  cockpit.  The  recording  of  these  video  images  should  be  at  a 
frame  rate  and  resolution  sufficient  for  capturing  such  actions.  The  cockpit  image  recorder  should 
be  mounted  in  the  aft  portion  of  the  aircraft  for  maximum  survivability  and  should  be  equipped 
with  an  independent  auxiliary  power  supply  that  automatically  engages  and  provides  10  minutes 
of  operation  whenever  aircraft  power  to  the  cockpit  image  recorder  and  associated  cockpit 
camera  system  ceases,  either  by  normal  shutdown  or  by  a  loss  of  power  to  the  bus.  The  circuit 
breaker  for  the  cockpit  image  recorder  system,  as  well  as  the  circuit  breakers  for  the  CVR  and  the 
DFDR,  should  not  be  accessible  to  the  flight  crew  during  flight. 

For  newly  manufactured  aircraft,  the  recommended  time  frame  for  equipping  aircraft  with 
two  combination  CVR/DFDR  recording  systems  and  an  auxiliary  power  supply  was  January  1, 
2003  (Safety  Recommendation  A-99-17).  As  previously  mentioned,  the  technology  currently 
exists  to  incorporate  CVR,  DFDR,  and  image  recording  functions  in  a  single  unit.  Therefore,  the 
Safety  Board  believes  that  the  FAA  should  require  that  all  aircraft  manufactured  after  January  1 , 
2003,  operated  under  Part  121,  125,  or  135  and  required  to  be  equipped  with  a  CVR  and  DFDR 
also  be  equipped  with  two  crash-protected  cockpit  image  recording  systems.  The  cockpit  image 
recorder  systems  should  have  a  2-hour  recording  duration,  as  a  minimum,  and  be  capable  of 
recording,  in  color,  a  view  of  the  entire  cockpit  including  each  control  position  and  each  action 
(such  as  display  selections  or  system  activations)  taken  by  people  in  the  cockpit.  The  recording  of 
these  video  images  should  be  at  a  frame  rate  and  resolution  sufficient  for  capturing  such  actions. 
One  recorder  should  be  located  as  close  to  the  cockpit  as  practicable  and  the  other  as  far  aft  as 
practicable.  These  recorders  should  be  equipped  with  independent  auxiliary  power  supplies  that 
automatically  engage  and  provide  1 0  minutes  of  operation  whenever  aircraft  power  to  the  cockpit 
image  recorders  and  associated  cockpit  camera  systems  ceases,  either  by  normal  shutdown  or  by  a 
loss  of  power  to  the  bus.  The  circuit  breaker  for  the  cockpit  image  recorder  systems,  as  well  as 
the  circuit  breakers  for  the  CVRs  and  the  DFDRs,  should  not  be  accessible  to  the  flight  crew 
during  flight. 
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Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Require  that  all  aircraft  operated  under  Title  14  Code  of  Federal  Regulations  Part 
121,  125,  or  135  and  currently  required  to  be  equipped  with  a  cockpit  voice 
recorder  (CVR)  and  digital  flight  data  recorder  (DFDR)  be  retrofitted  by 
January  1,  2005,  with  a  crash-protected  cockpit  image  recording  system.  The 
cockpit  image  recorder  system  should  have  a  2-hour  recording  duration,  as  a 
minimum,  and  be  capable  of  recording,  in  color,  a  view  of  the  entire  cockpit 
including  each  control  position  and  each  action  (such  as  display  selections  or 
system  activations)  taken  by  people  in  the  cockpit.  The  recording  of  these  video 
images  should  be  at  a  frame  rate  and  resolution  sufficient  for  capturing  such 
actions.  The  cockpit  image  recorder  should  be  mounted  in  the  aft  portion  of  the 
aircraft  for  maximum  survivability  and  should  be  equipped  with  an  independent 
auxiliary  power  supply  that  automatically  engages  and  provides  10  minutes  of 
operation  whenever  aircraft  power  to  the  cockpit  image  recorder  and  associated 
cockpit  camera  system  ceases,  either  by  normal  shutdown  or  by  a  loss  of  power  to 
the  bus.  The  circuit  breaker  for  the  cockpit  image  recorder  system,  as  well  as  the 
circuit  breakers  for  the  CVR  and  the  DFDR,  should  not  be  accessible  to  the  flight 
crew  during  flight.  (A-00-30) 

Require  that  all  aircraft  manufactured  after  January  1,  2003,  operated  under  Title 
14  Code  of  Federal  Regulations  Part  121,  125,  or  135  and  required  to  be 
equipped  with  a  cockpit  voice  recorder  (CVR)  and  digital  flight  data  recorder 
(DFDR)  also  be  equipped  with  two  crash-protected  cockpit  image  recording 
systems.  The  cockpit  image  recorder  systems  should  have  a  2-hour  recording 
duration,  as  a  minimum,  and  be  capable  of  recording,  in  color,  a  view  of  the  entire 
cockpit  including  each  control  position  and  each  action  (such  as  display  selections 
or  system  activations)  taken  by  people  in  the  cockpit.  The  recording  of  these 
video  images  should  be  at  a  frame  rate  and  resolution  sufficient  for  capturing  such 
actions.  One  recorder  should  be  located  as  close  to  the  cockpit  as  practicable  and 
the  other  as  far  aft  as  practicable.  These  recorders  should  be  equipped  with 
independent  auxiliary  power  supplies  that  automatically  engage  and  provide 
10  minutes  of  operation  whenever  aircraft  power  to  the  cockpit  image  recorders 
and  associated  cockpit  camera  systems  ceases,  either  by  normal  shutdown  or  by  a 
loss  of  power  to  the  bus.  The  circuit  breaker  for  the  cockpit  image  recorder 
systems,  as  well  as  the  circuit  breakers  for  the  CVRs  and  the  DFDRs,  should  not 
be  accessible  to  the  flight  crew  during  flight.  (A-00-31) 
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Chairman  HALL,  and  Members  HAMMERSCHMIDT,  GOGLIA,  and  BLACK  concurred 
in  these  recommendations. 


